2c9f6eb12e54dc050da0a150ffc6398445756d509138a5dfae830102282d372e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
Size 17.7MB
Sample260813-e9dtzazyc1
SHA256 2c9f6eb12e54dc050da0a150ffc6398445756d509138a5dfae830102282d372e
MD5 70c7434b4b2432f308787f0b58d562a1
SHA1 3c7f8a379d903b3baaa8410e6f16eda9cc68c136
SHA512 93e41843502785da066a4d47f5e9cd2820961e919e4db7103c3138489edb00ba7cdfa43e3e2540fb5e54d5548a6bdb7a8ae15fd0ec0bd1c6fb704d21bfd3fb44
SSDEEP 49152:U+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+Ee:p
TLSH
T189173C09F94350B1D92B51B04DCBD3BF8A30BB2582128EFBFB4DC75BA933B916428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
3608	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBBCCCCABAAABBCACCBBABACBABBACCCBBBCBBCACBBABCACBBBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe"	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2244	sc.exe
4308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2284	cmd.exe
4136	cmd.exe
816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2284	2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe	103
PID 2284 wrote to memory of 704	2284	cmd.exe	105
PID 2996 wrote to memory of 4136	2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe	112
PID 4136 wrote to memory of 2244	4136	cmd.exe	114
PID 2996 wrote to memory of 816	2996	2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe	115
PID 816 wrote to memory of 4308	816	cmd.exe	117
PID 1264 wrote to memory of 2052	1264	svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe	119
PID 2052 wrote to memory of 4452	2052	notepad.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_70c7434b4b2432f308787f0b58d562a1_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBAACCBAAABAACCBBBCABCBABCACCBABBCCBACCBCBBBCBABCBBCAABCBCABBBAACABBAACACCBACABCCAAACAAABCCCBAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBAACCBAAABAACCBBBCABCBABCACCBABBCCBACCBCBBBCBABCBBCAABCBCABBBAACABBAACACCBACABCCAAACAAABCCCBAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe" start= auto displayName= "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe" start= auto displayName= "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCBACAAABBBAAACCAACAACCBBCAAABBCACBCCCBAABCAABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
1⤵
- Executes dropped EXE
PID:3608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0264678870667d390c7d49eb46ed7371831cf23a33062a068830194137f7029
MD5 b848920c51f82781ab42341320a27868
SHA1 403f0fd953273bd3653f43f357ad9bd7ff2e59ab
SHA512 46b810bf5b536749bcbb9590716193b6647d9d374c7ff8c07704ea3fa0b525954d392999ad1f2a8e116c0a6a077f1fecccbf04f433d63034a3c652362d0dc082
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0b68370a9ec95e170868c961cdd9ffd9ca53e59bdd5798148533fc614c6ab8b
MD5 9579b24ba3fc11b569eb0a07a86e590c
SHA1 860d9fe3c43a78eb49dc7a84195300c1b16c58f6
SHA512 fa3aa068f45137b93ee3fcc5431cec6a4902fca033cb9b64ec16a280543fb0cdc2b0cf1145d2b266f71088a955a8034469a671db0e002495870d54ed646e3e9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3dfabd3690a047814cbd2cea0ee619d51647179dd202e602eb8aafa719f49914
MD5 f6595e3cc7c797568438bd487f325eef
SHA1 d63bb1961ee13fca0fbab07f6047819ab00b2daf
SHA512 1f83d1525b7008dfa9157af04d4ba25f75444d46a316b0a85216205d199a9e99f12fedea65823dbc46a0484894103e005106d25bd0e03ee7d006fb94d5de051c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 92d10b30a5f1403bcb725bca582b3a05495e5a7644a5e3772ebb2c6c8b7d69c5
MD5 bdbc87347d40a69627e0cd05f1b5f5ee
SHA1 48750214c5707b467bb832aecc92d70d153fb750
SHA512 7e670357691256c60af0e13c4642f951fa1b90f7a276d1855efd3d03b84a11d3ddf0b2922fd42baf6784881c7330ebd3c9bf9c857f7a44af8225855b7ef07abc
MD5 SHA1 SHA512

Submit Download

svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAABCACBABACCBBACBACBBACCBABCCBBAACBBAAABAACCABBCBAB.exe
Size 17.7MB
SHA256 2c9f6eb12e54dc050da0a150ffc6398445756d509138a5dfae830102282d372e
MD5 70c7434b4b2432f308787f0b58d562a1
SHA1 3c7f8a379d903b3baaa8410e6f16eda9cc68c136
SHA512 93e41843502785da066a4d47f5e9cd2820961e919e4db7103c3138489edb00ba7cdfa43e3e2540fb5e54d5548a6bdb7a8ae15fd0ec0bd1c6fb704d21bfd3fb44
SSDEEP 49152:U+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+Ee:p
TLSH
T189173C09F94350B1D92B51B04DCBD3BF8A30BB2582128EFBFB4DC75BA933B916428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-57-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/1264-54-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/1264-37-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/1264-77-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/1264-82-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/2052-89-0x0000000005A60000-0x0000000005A61000-memory.dmp

Download

memory/2996-38-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2996-0-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2996-64-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2996-25-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2996-12-0x0000000000960000-0x0000000000981000-memory.dmp

Download